DBS-C01 Management and Operations Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:CreateDBSnapshot",
        "rds:DeleteDBSnapshot",
        "rds:DescribeDBSnapshots",
        "rds:ModifyDBSnapshotAttribute",
        "rds:CopyDBSnapshot"
      ],
      "Resource": "*"
    }
  ]
}

An administrator is troubleshooting a permissions issue. A user with the IAM policy shown is unable to share an automated system snapshot with another AWS account. Which action should the administrator take to resolve this issue?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Change the Resource to "arn:aws:rds:us-east-1:123456789012:snapshot:automated:*".

The policy allows actions on DB snapshots, but automated snapshots have the resource type 'automated-snapshot' and require explicit resource ARN instead of '*'. Option A is wrong because the policy already includes the necessary actions. Option B is wrong because the issue is not about cross-region copying. Option D is wrong because the issue is not about manual snapshots.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Add the rds:ModifyDBSnapshotAttribute action to the policy.
Why it's wrong here
The policy already includes this action.
✗
Add the rds:CopyDBSnapshot action for cross-region copy.
Why it's wrong here
The issue is about sharing, not copying.
✓
Change the Resource to "arn:aws:rds:us-east-1:123456789012:snapshot:automated:*".
Why this is correct
Automated snapshots require a resource ARN that includes 'automated'.
✗
Change the Resource to "arn:aws:rds:us-east-1:123456789012:snapshot:rds:*".
Why it's wrong here
Manual snapshots use 'rds:', but automated snapshots use 'automated:'.

Visual reference

Go deeper

1 more way this is tested on DBS-C01

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. An IAM policy statement allows creating manual snapshots for an RDS instance. A database administrator is unable to create a snapshot from the AWS Management Console. The error message indicates insufficient permissions. What is the likely cause?

hard

A.The condition key 'aws:RequestedRegion' is misspelled.
✓ B.The policy does not include necessary read actions (e.g., 'DescribeDBInstances', 'DescribeDBSnapshots') that the console uses.
C.The resource ARN is incorrect; it should include the snapshot ARN.
D.The condition uses 'StringEquals' but should use 'StringLike' for region matching.

Why B: The AWS Management Console often performs multiple API calls (such as DescribeDBInstances and DescribeDBSnapshots) to list and display resources before allowing actions. Even if the CreateDBSnapshot action is allowed, the console will fail if it cannot describe the instance or snapshots. Option A is incorrect because the condition key 'aws:RequestedRegion' is correctly spelled. Option C is incorrect because the resource ARN correctly identifies the RDS instance for snapshot creation. Option D is incorrect because StringEquals is appropriate for matching the region exactly; StringLike is not needed.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.

DBS-C01 Management and Operations Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

1 more way this is tested on DBS-C01